AI Agents for AWS SHIP, Powered by AlertD

Today we are announcing AlertD support for the AWS Security Health Improvement Program (SHIP), and opening early access for the partners who deliver it. We are also welcoming Mike Geehan as AlertD's CISO. Mike led security at Cockroach Labs and brings two decades in cybersecurity, with earlier roles at Akamai and HP.

AlertD is built by Cisco, AppDynamics, Splunk, and Fortinet alumni: cloud ops agents for security, cost, compliance, performance, and LLM. Not bots you build. Not agents that watch one lane. Agents that know AWS end to end.

Same program. Same rigor. More of it, for more customers.

SHIP works because of the people behind it

If you have not done a SHIP engagement, ask your AWS team about one. It is a no cost program where someone who knows AWS deeply sits down with you, listens to your priorities, walks through ten core security use cases, and builds a prioritized roadmap with you rather than for you. It is impartial, it is collaborative, and the value is the conversation.

That someone is not always an AWS Solutions Architect. Through PartnerSHIP, AWS partners deliver SHIP engagements to their own clients, and a growing number of them run the assessments themselves rather than waiting on an AWS team to do it. Same program, same ten use cases, same prioritized roadmap at the end, delivered by the partner who already knows the account.

Either way, the assessment tooling behind the conversation is a means to an end. The end is a customer who understands their posture and knows what to do next.

We built AlertD to serve that same end.

The toil tax

The assessments AWS uses in a SHIP engagement are good, and they are built by AWS. SATv2 covers 160+ critical and high resource level checks. SRA Verify adds 158 checks confirming organization wide deployment of AWS security services against the Security Reference Architecture.

What slows an engagement down is not the assessment. It is everything around it. Standing up SATv2 and SRA Verify. Waiting on approvals. Collecting the output. Assembling it into something a customer can act on. Per client, per engagement, by hand.

If you deliver SHIP yourself, you know the shape of this. Learning to deploy both assessments is its own afternoon. Doing it for the fifth client in a quarter is not a learning exercise anymore, it is overhead.

That is the toil tax, and it gets paid by your best people. Findings are not fixes. Discovery without context is just more work, assigned to you.

So the conversation that should be about the customer's priorities ends up being about their data.

Discover. Context. Act.

AlertD's agents run the full SHIP question set natively, 319 questions across SATv2 and SRA Verify, as a built in profile. Nothing about the assessment changes. What changes is who does the legwork.

Discover. Read only access, installed inside the customer's own VPC. The agents walk the whole estate, every account, every Region, the LLM stack included, and build a live graph of resources, metrics, pricing, and relationships. Nothing leaves the account.

Context. This is the part that matters. Take one finding: a security group open to the internet. Does it actually matter? By hand that is hours of digging. Is the resource internet facing, does it touch sensitive data, how many others share the same misconfiguration. The agents answer that for every finding at once, and they know what each resource is actually for, so a box that is over provisioned on purpose does not get flagged like a mistake. Your team can adjust the risk or add context directly on a finding, and the agents carry that knowledge forward.

Act. Every finding arrives with a proposed fix.

Install from AWS Marketplace takes about 15 minutes. Ingest takes about 30. First answers land inside the hour. Value in 45 minutes, which means you can schedule an engagement around it.

Findings are table stakes

Every tool in this category can produce a list of findings. That has been true for years, and it is not where the time goes.

The time goes into what happens after the list. That is the work the agents do.

It is also why we did not build another place to log into. A tool you onboard every client into is a tool somebody has to sit in. AlertD's agents work where the work already happens: in the account, in Slack, in whatever AI tooling your engineers already use.

And a script that answers one question in one account is not the same thing as a platform that holds its shape across dozens of accounts, many Regions, and a whole client organization. Anyone can generate a check. Running the full set every time, with context attached, across an estate that changes daily, is a different problem. Cross account IAM, rate limits, millions of graph edges, regression suites, and guardrails that stop bad actions. The danger is not a homegrown bot that crashes. It is one that silently misses half the cloud.

Already building your own agents? Keep them. Connect them over MCP, the same open standard AWS builds its own agents on, and ours will brief yours.

Continuous security improvement, not a snapshot

A SHIP engagement captures a moment, and environments keep moving after the meeting ends. Continuous improvement is the whole point of the program, and it is the hardest part to actually deliver, because it means going back and doing the work again.

Run the profile again and the score moves. The next conversation starts from today's posture instead of last quarter's, and remediation becomes something the customer can watch happen rather than something they promise to get to.

To be clear about what this is not: AlertD is not a monitoring product and it does not replace AWS Security Hub or a partner CSPM. The service adoption checks point customers toward Security Hub, GuardDuty, and partner offerings, because a customer protected by a partner tool is a protected customer. AlertD is built to sit alongside what is already on the list.

Partners have several good options for running these assessments, and that is how it should be. AlertD is the one for teams who would rather have agents do the run than do it by hand.

The SHIP engagement establishesAlertD carries it forwardA prioritized roadmap across ten core security use cases, built with an AWS expertThe same assessment, re run whenever you want, so the roadmap starts from todayThe assessment output, walked through in the delivery meetingA printable SHIP report in the same shape, regenerated on every runPrescriptive recommendations for the findings that matterA proposed fix per finding: console, CLI, CloudFormation, TerraformFindings ranked by standardized severitySeverity plus blast radius: internet exposure, sensitive data, resources affectedSecurity service adoption gaps mapped to use casesAdoption checked directly, and re checked until it is closedThe security baseline AI workloads requireOngoing visibility into Bedrock guardrails, prompt attack filters, and live LLM traffic

Five disciplines, one set of agents

Security is where SHIP starts. It is not where the work stops, and it is the same agents, with the same context, across all of it.

Compliance. Artifacts pulled from the live environment and mapped control by control. NIST 800-171, CMMC Level 2, SOC 2 evidence, with drift watch on. No screenshot archaeology.

Cost. Rightsizing, idle resources, zombie EKS pods, GPU waste, gp2 to gp3 migrations, continuously and org wide. The quarterly "why is the bill up 30 percent" hunt becomes a standing report with the evidence attached.

Performance. CPU, memory, and 5xx storms traced to the exact resource and cause, with the fix path. The multi day war room becomes a question you ask in Slack.

LLM governance. We watched one production account go from 600 dollars a day to 9,000 dollars a day, with no warning, one day in five. AlertD meters every token daily, shows cost per feature, and flags budget breaches the day they start. Same agents, same VPC.

Then there are the jobs that used to need their own point tool or their own consultant. Internet facing exposure. Cloud identity and entitlements. Cyber asset inventory. Attack path analysis. Incident investigation. LLM observability. IaC drift. Data exposure and encryption posture. One question in chat, and the context comes back in seconds.

Headless by design

Nobody needs another place to log into. The agents are wherever you already are.

In Slack, ask Flappy in plain language and get the answer in the thread. "I've had several AWS cost anomalies, please investigate and give me a summary." Back comes the driver, the dollar figure, the smaller contributors, and the proposed fixes. No new tab.

Over MCP, your coding agent sees all of AWS through the AlertD MCP server. Ask why the bill spiked this month from your own terminal and the agents walk the accounts, correlate Cost Explorer against CloudWatch and deploys, and hand back the top driver with a fix ready.

The UI is there when you want the full picture. Nobody is required to live there.

Priced by the work, not by the seat

The human driven stack charges twice. License fees for tools that surface data, then your engineers' hours to turn that data into decisions.

AlertD is metered in tokens, the unit of an agent's effort, with hard caps you set. No per seat, per host, or per workload pricing. No upfront annual commitment. No long term lock in. Old software pricing counts your people. Agent pricing counts the work.

Buy on AWS Marketplace and the purchase lands on your existing AWS bill under standard Marketplace terms. Procurement has already approved the vendor, and Marketplace spend can count toward your AWS commit.

Your VPC. Your models. Your call.

Not a SaaS. AlertD is delivered as a container on Amazon ECS, deployed inside your own perimeter. Your operational data never leaves it.

Bring your own model through Amazon Bedrock. Prompts and reasoning stay inside your boundary. AlertD holds no write permissions, fixes arrive as diffs ready for your PR workflow, actions are logged, and nothing changes unless your team changes it. SOC 2 Type II.

This is the autonomy level Gartner calls "Act with Approval." The agents propose. You approve. Your pipeline applies.

Proof, not adjectives

"We've achieved insights on our AWS environment in seconds that would normally take hours."

Senior Director of DevOps, geospatial intelligence company

Measured in production: faster diagnostics, P0s identified in minutes, audit artifacts in seconds rather than days.

For AWS customers

Deploy AlertD from AWS Marketplace into your own VPC and have agents at work within the hour. Free 30 day trial, no contract to sign first.

Let's make money together

If you run AWS for other people, the agents are leverage. One deployment per client. Prep that used to take days takes under an hour. And every SHIP report is a prioritized roadmap you can quote against, which is the work clients actually want done.

This matters most if you have already built a practice around it. If your firm holds an AWS Competency, an MSP designation, or Service Delivery and Service Ready validations, the constraint on growth is rarely demand. It is how many engagements your senior people can personally carry in a quarter.

Three things change for your practice. More engagements, because prep stops being the constraint and the same consultants have more client conversations per quarter. More follow on work, because the assessment stops being the deliverable and becomes the front door to one. Nothing to buy to start, because it is Marketplace billing on your client's own AWS account.

If you are a PartnerSHIP partner running your own assessments, that is exactly the workload the agents were built for. And if you are the person who has to make the commercial case rather than run the tooling, the model is simple: no seats to forecast, no annual commitment to sign, spend that lands on your client's existing AWS bill, and credits to get the first engagements moving.

We are building the partner program now, and the partners coming in through early access are the ones shaping it: AlertD credits for your first client engagements, support on live deals, and a commercial model built for a practice rather than a single account.

Bring us a client conversation and we will help you run it. Tell us the client, roughly how many accounts, and when the meeting is. Talk to us at alertd.ai/ship.

Why we built it

"We did not build AlertD to replace the people who deliver SHIP. We built it to give them better instruments. The agents run the full assessment, carry the context of the whole environment, and hand the team a proposed fix in the format they already work in. What used to take an engagement cycle takes an hour. The humans bring the judgment. That was never the bottleneck. The legwork was."

Freddy Mangum, COO and Co-Founder, AlertD

"I have sat in the operator's seat with 400 critical findings on the screen and no way to tell which ones could actually hurt me. You get numb to it. What matters is not the length of the list, it is knowing which item is exploitable, which resource it touches, and what the fix looks like. That is the work these agents do, and it is why I joined."

Mike Geehan, CISO, AlertD

Get started

• Deploy from AWS Marketplace, about 15 minutes to install and value in 45
• SHIP partners, request early access at alertd.ai/ship for AlertD credits on your first client engagements
• New to SHIP? Ask your AWS team about an engagement